diff --git a/src/core/server/app/middleware/passport/index.ts b/src/core/server/app/middleware/passport/index.ts
index 48c85eeac..693d7d912 100644
--- a/src/core/server/app/middleware/passport/index.ts
+++ b/src/core/server/app/middleware/passport/index.ts
@@ -92,7 +92,11 @@ export async function handleLogout(redis: Redis, req: Request, res: Response) {
   const { jti, exp }: LogoutToken = validate(LogoutTokenSchema, decoded);
   if (jti && exp) {
     // Compute the number of seconds that the token will be valid for.
-    const validFor = exp - now.valueOf() / 1000;
+    const validFor = Math.round(
+      DateTime.fromJSDate(now)
+        .plus({ seconds: -exp })
+        .toSeconds()
+    );
     if (validFor > 0) {
       // Invalidate the token, the expiry is in the future and it needs to be
       // revoked.
diff --git a/src/core/server/services/jwt/index.ts b/src/core/server/services/jwt/index.ts
index 565c0a223..63a38519f 100644
--- a/src/core/server/services/jwt/index.ts
+++ b/src/core/server/services/jwt/index.ts
@@ -3,6 +3,7 @@ import { IncomingMessage } from "http";
 import { Redis } from "ioredis";
 import Joi from "joi";
 import jwt, { SignOptions, VerifyOptions } from "jsonwebtoken";
+import { DateTime } from "luxon";
 import { Bearer, BearerOptions } from "permit";
 import uuid from "uuid/v4";
 
@@ -352,8 +353,8 @@ export async function revokeJWT(
 ) {
   await redis.setex(
     generateJTIRevokedKey(jti),
-    Math.ceil(validFor),
-    now.valueOf()
+    Math.round(validFor),
+    Math.round(DateTime.fromJSDate(now).toSeconds())
   );
 }
 
diff --git a/src/core/server/services/users/auth/invite.ts b/src/core/server/services/users/auth/invite.ts
index f5f66d780..f650c79eb 100644
--- a/src/core/server/services/users/auth/invite.ts
+++ b/src/core/server/services/users/auth/invite.ts
@@ -86,7 +86,7 @@ export async function generateInviteURL(
     jti: uuid.v4(),
     iss: tenant.id,
     sub: id,
-    exp: Math.floor(user.expiresAt.valueOf() / 1000),
+    exp: Math.round(DateTime.fromJSDate(user.expiresAt).toSeconds()),
     iat: nowSeconds,
     nbf: nowSeconds,
     aud: "invite",
diff --git a/src/core/server/services/users/index.ts b/src/core/server/services/users/index.ts
index e8d2cdecb..5cd42b09a 100644
--- a/src/core/server/services/users/index.ts
+++ b/src/core/server/services/users/index.ts
@@ -283,7 +283,7 @@ export async function createToken(
     issuer: tenant.id,
 
     // Tokens are not valid before the creation date.
-    notBefore: DateTime.fromJSDate(now).toSeconds(),
+    notBefore: Math.round(DateTime.fromJSDate(now).toSeconds()),
   });
 
   return { ...result, signedToken };